Colorado — from risk-based regulation to repeal; and US state divergence

What Happened

Colorado passed the first comprehensive US state AI Act in 2024 (SB 24-205), a risk-based framework inspired by the EU AI Act: a duty of care against algorithmic discrimination, risk management programs, and annual impact assessments for high-risk systems in consequential decisions. It never took effect in that form. It was delayed twice — to June 30, 2026 (SB 25B-004, August 2025) — then repealed and replaced by SB 26-189, signed by Governor Polis on May 14, 2026, effective January 1, 2027. The new law removes the duty of care, the risk-management obligations, and the impact assessments, shifting to a narrow disclosure-and-transparency regime over automated decision-making technology (ADMT), enforced solely by the Attorney General, with no private right of action. The retreat was accelerated by federal pressure: the December 11, 2025 executive order "Ensuring a National Policy Framework for AI" directed an AI Litigation Task Force to challenge state AI laws; xAI sued Colorado (April 2026), the DOJ intervened, and a federal magistrate stayed enforcement on April 27, 2026.

MEG 2 Analysis - Legal Framework

Direct relevance — not a validation of convergence, but of the fragility of centralized regulation: Colorado does not support a global convergence toward risk-based governance. It illustrates the opposite: the fragility of a centralized risk-based regime under combined industry and federal pressure. The very provisions that would have mapped to MEG 2 mechanisms - annual impact assessments (analogous to continuous DAI/ISR monitoring, 5.2) and risk management programs (analogous to N1/N2/N3 grading, Chapter 5) - are precisely the ones that were removed. The case therefore cannot be cited as legislative confirmation of those mechanisms.
The significance for MEG 2 is structural, and stronger than a mere convergence of principles:
1. Empirical validation of Chapter 8 (adoption as a protocol): Colorado shows that a risk-based legislative mandate can be dismantled within weeks when political consensus fails. A voluntary, verifiable technical standard, adopted bottom-up and anchored contractually and through insurance (the MEG 2 model) does not depend on that consensus and survives the legislative cycles that dissolved SB 24-205.
2. Validation of Chapter 2.2 (the verification vacuum): With Colorado's duty of care and impact assessments removed, the EU AI Liability Directive withdrawn (C/2025/5423), and US federal policy oriented toward preemption, the verifiable diligence obligation disappears from positive law, leaving disclosure regimes without independent verification. This is exactly the gap an auditor-issued DAI/ISR layer can fill where the law no longer mandates it, as a contractual and insurance instrument, not a state mandate.
3. State divergence as an argument for a common technical layer: In the same window, California (AB 316, effective January 1, 2026) eliminates the autonomy defense, while Texas (TRAIGA, same date) adopts an intent-based model rather than an impact-based one. Three states, three divergent liability philosophies. This fragmentation is itself the Chapter 2.2 argument for a common technical layer of identity and allocation that provides coherence without cancelling sectoral or state-level flexibility.

Procedural Mechanism

Chapter 8 (adoption as a protocol): the Colorado cycle (enactment → delay → repeal) confirms that state recognition is unstable and that a modular model, independent of central political consensus, is more resilient, not because it anticipates convergence, but because it survives divergence and retreat.
2.2 (USA — context update): section 2.2 updates from "federal deregulation" to "federal deregulation + active preemption of states + collapse of the first state risk-based mandate", reinforcing that a legislative mandate cannot be the framework's premise.